What a rate limit actually admits.

The number in the config is not the number that gets through, and the gap opens in five places. A fixed window admits exactly 2× its limit — 100 per 1m becomes 200, because two adjacent counters each admit their limit and a sliding window of the same length can contain the end of one and the start of the other. Not a rounding error and not a margin to tune: a cron job on a round schedule finds that boundary every time.

The engine is free and needs no account, and it generates no load: every figure is arithmetic on the sheet you paste. A token bucket admits B + floor(r × elapsed) — a bucket of 50 refilling at 10/s admits 50 in one instant, 60 over the first second against a stated 10 (6×), and every implementation defaults the capacity to the limit, which is what makes it invisible. Per-key limits multiply: 100 per 1m across 8,000 keys is 13,333.33/s against a backend that takes 800/s — 17× too loose to be protection, and a faithful per-key limit would be 6 per 1m, which no caller could use. So a per-key limit is fairness between callers and only a rule in front of all the traffic is protection. A concurrency limit is not a rate: 5 in flight is 500/s at 10ms and 1/s at 5s, 500× the throughput from the same number. And a debounce is a step — 121 events 499ms apart under a 500ms delay fire once, and at 500ms they all fire. Only a sliding window log admits what it says, and it costs one timestamp per admitted request per key, for a whole window. Every lane ships a worked example that costs nothing. Writing the report needs credits.